fix(agents): forward channel identity to CLI hooks

vincentkoc · vincentkoc · commit 60e818f563d8 · 2026-06-11T19:33:00.000+09:00
diff --git a/src/agents/cli-runner.reliability.test.ts b/src/agents/cli-runner.reliability.test.ts
@@ -1700,6 +1700,76 @@ describe("runCliAgent reliability", () => {
     }
   });
 
+  it("forwards channel identity context to CLI before_agent_run hooks", async () => {
+    supervisorSpawnMock.mockClear();
+    const hookRunner = {
+      hasHooks: vi.fn((hookName: string) => hookName === "before_agent_run"),
+      runBeforeAgentRun: vi.fn(async () => ({
+        pluginId: "policy-plugin",
+        decision: {
+          outcome: "block" as const,
+          reason: "sender scoped policy",
+          message: "The agent cannot read this message.",
+        },
+      })),
+    };
+    setHookRunnerForTest(hookRunner);
+    const { dir, sessionFile } = createSessionFile();
+
+    try {
+      const context = buildPreparedContext({
+        sessionKey: "agent:main:telegram:chat-1",
+        runId: "run-cli-channel-before-agent-run",
+      });
+      const result = await runPreparedCliAgent({
+        ...context,
+        params: {
+          ...context.params,
+          agentId: "main",
+          sessionFile,
+          workspaceDir: dir,
+          prompt: "sender scoped prompt",
+          messageChannel: "telegram",
+          messageProvider: "telegram",
+          currentChannelId: "telegram:chat-1",
+          senderId: "user-42",
+          senderIsOwner: true,
+          userTurnTranscriptRecorder: createCliUserTurnRecorder({
+            text: "sender scoped prompt",
+            sessionFile,
+            sessionKey: "agent:main:telegram:chat-1",
+            workspaceDir: dir,
+          }),
+        },
+      });
+
+      expect(result.payloads).toEqual([
+        {
+          text: "Your message could not be sent: The agent cannot read this message. (blocked by policy-plugin)",
+          isError: true,
+        },
+      ]);
+      expect(supervisorSpawnMock).not.toHaveBeenCalled();
+      const beforeRunEvent = requireRecord(
+        callArg(hookRunner.runBeforeAgentRun, 0, 0, "before_agent_run event"),
+        "before_agent_run event",
+      );
+      expect(beforeRunEvent.channelId).toBe("chat-1");
+      expect(beforeRunEvent.senderId).toBe("user-42");
+      expect(beforeRunEvent.senderIsOwner).toBe(true);
+      const beforeRunContext = requireRecord(
+        callArg(hookRunner.runBeforeAgentRun, 0, 1, "before_agent_run context"),
+        "before_agent_run context",
+      );
+      expect(beforeRunContext.channel).toBe("telegram");
+      expect(beforeRunContext.chatId).toBe("chat-1");
+      expect(beforeRunContext.channelId).toBe("chat-1");
+      expect(beforeRunContext.senderId).toBe("user-42");
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it("does not emit llm_output when the CLI run returns no assistant text", async () => {
     const hookRunner = {
       hasHooks: vi.fn((hookName: string) => hookName === "llm_output"),
diff --git a/src/agents/cli-runner.spawn.test.ts b/src/agents/cli-runner.spawn.test.ts
@@ -654,13 +654,17 @@ describe("runCliAgent spawn path", () => {
       currentChannelId: "telegram:-100123:topic:42",
       currentThreadTs: "42",
       currentMessageId: "reply-message-1",
+      senderId: "sender-1",
+      senderIsOwner: true,
     });
 
     expect(params.messageChannel).toBe("telegram");
     expect(params.messageProvider).toBe("acp");
     expect(params.currentChannelId).toBe("telegram:-100123:topic:42");
     expect(params.currentThreadTs).toBe("42");
     expect(params.currentMessageId).toBe("reply-message-1");
+    expect(params.senderId).toBe("sender-1");
+    expect(params.senderIsOwner).toBe(true);
     expect(params.cwd).toBe("/tmp/task-repo");
   });
 
diff --git a/src/agents/cli-runner.ts b/src/agents/cli-runner.ts
@@ -750,6 +750,8 @@ export async function runPreparedCliAgent(
             }),
             channelId: hookContext.channelId,
             accountId: params.agentAccountId,
+            senderId: params.senderId ?? undefined,
+            senderIsOwner: params.senderIsOwner ?? undefined,
           },
           buildAgentHookContext(hookContext),
         );
@@ -901,6 +903,8 @@ export function buildRunClaudeCliAgentParams(params: RunClaudeCliAgentParams): R
     currentThreadTs: params.currentThreadTs,
     currentMessageId: params.currentMessageId,
     currentInboundAudio: params.currentInboundAudio,
+    senderId: params.senderId,
+    senderIsOwner: params.senderIsOwner,
   };
 }
 
diff --git a/src/agents/cli-runner/prepare.test.ts b/src/agents/cli-runner/prepare.test.ts
@@ -596,6 +596,9 @@ describe("shouldSkipLocalCliCredentialEpoch", () => {
         model: "test-model",
         timeoutMs: 1_000,
         runId: "run-test-turn-prepare",
+        messageChannel: "telegram",
+        currentChannelId: "chat-1",
+        senderId: "user-456",
         config: createCliBackendConfig(),
       });
 
@@ -610,10 +613,19 @@ describe("shouldSkipLocalCliCredentialEpoch", () => {
         queuedInjections: [],
       });
       const turnPrepareContext = agentTurnPrepareCalls[0]?.[1] as
-        | { runId?: string; sessionKey?: string }
+        | {
+            channel?: string;
+            chatId?: string;
+            runId?: string;
+            senderId?: string;
+            sessionKey?: string;
+          }
         | undefined;
       expect(turnPrepareContext?.runId).toBe("run-test-turn-prepare");
       expect(turnPrepareContext?.sessionKey).toBe("agent:main:test");
+      expect(turnPrepareContext?.channel).toBe("telegram");
+      expect(turnPrepareContext?.chatId).toBe("chat-1");
+      expect(turnPrepareContext?.senderId).toBe("user-456");
       expect(hookRunner.runBeforePromptBuild).not.toHaveBeenCalled();
       expect(hookRunner.runBeforeAgentStart).not.toHaveBeenCalled();
     } finally {
@@ -650,6 +662,9 @@ describe("shouldSkipLocalCliCredentialEpoch", () => {
         model: "test-model",
         timeoutMs: 1_000,
         runId: "run-test-legacy-merge",
+        messageChannel: "discord",
+        currentChannelId: "channel:room-1",
+        senderId: "user-789",
         config: createCliBackendConfig(),
       });
 
@@ -659,6 +674,24 @@ describe("shouldSkipLocalCliCredentialEpoch", () => {
       );
       expect(hookRunner.runBeforePromptBuild).toHaveBeenCalledOnce();
       expect(hookRunner.runBeforeAgentStart).toHaveBeenCalledOnce();
+      const beforePromptBuildCalls = hookRunner.runBeforePromptBuild.mock.calls as unknown as Array<
+        [unknown, unknown]
+      >;
+      const promptContext = beforePromptBuildCalls[0]?.[1] as
+        | { channel?: string; chatId?: string; senderId?: string }
+        | undefined;
+      expect(promptContext?.channel).toBe("discord");
+      expect(promptContext?.chatId).toBe("room-1");
+      expect(promptContext?.senderId).toBe("user-789");
+      const beforeAgentStartCalls = hookRunner.runBeforeAgentStart.mock.calls as unknown as Array<
+        [unknown, unknown]
+      >;
+      const legacyContext = beforeAgentStartCalls[0]?.[1] as
+        | { channel?: string; chatId?: string; senderId?: string }
+        | undefined;
+      expect(legacyContext?.channel).toBe("discord");
+      expect(legacyContext?.chatId).toBe("room-1");
+      expect(legacyContext?.senderId).toBe("user-789");
     } finally {
       fs.rmSync(dir, { recursive: true, force: true });
     }
diff --git a/src/agents/cli-runner/types.ts b/src/agents/cli-runner/types.ts
@@ -91,6 +91,8 @@ export type RunCliAgentParams = {
   currentMessageId?: string | number;
   currentInboundAudio?: boolean;
   agentAccountId?: string;
+  /** Sender identity for channel-originated runs when available. */
+  senderId?: string | null;
   /** Trusted sender identity bit for channel action auth. */
   senderIsOwner?: boolean;
   /** Runtime tool allow-list. CLI harnesses fail closed when this is set. */
diff --git a/src/agents/command/attempt-execution.cli.test.ts b/src/agents/command/attempt-execution.cli.test.ts
@@ -1126,7 +1126,10 @@ describe("CLI attempt execution", () => {
       opts: {
         messageProvider: "discord-voice",
       } as Parameters<typeof runAgentAttempt>[0]["opts"],
-      runContext: {} as Parameters<typeof runAgentAttempt>[0]["runContext"],
+      runContext: {
+        currentChannelId: "channel:voice-room",
+        senderId: "sender-voice",
+      } as Parameters<typeof runAgentAttempt>[0]["runContext"],
       spawnedBy: undefined,
       messageChannel: "discord",
       skillsSnapshot: undefined,
@@ -1144,6 +1147,8 @@ describe("CLI attempt execution", () => {
       trigger: "user",
       messageChannel: "discord",
       messageProvider: "discord-voice",
+      currentChannelId: "channel:voice-room",
+      senderId: "sender-voice",
     });
   });
 
diff --git a/src/agents/command/attempt-execution.ts b/src/agents/command/attempt-execution.ts
@@ -638,6 +638,7 @@ export function runAgentAttempt(params: {
         currentThreadTs: params.runContext.currentThreadTs,
         currentInboundAudio: params.runContext.currentInboundAudio,
         agentAccountId: params.runContext.accountId,
+        senderId: params.runContext.senderId,
         senderIsOwner: params.opts.senderIsOwner,
         toolsAllow: params.opts.toolsAllow,
         cleanupBundleMcpOnRunEnd: params.opts.cleanupBundleMcpOnRunEnd,
@@ -707,6 +708,7 @@ export function runAgentAttempt(params: {
     currentInboundAudio: params.runContext.currentInboundAudio,
     replyToMode: params.runContext.replyToMode,
     hasRepliedRef: params.runContext.hasRepliedRef,
+    senderId: params.runContext.senderId,
     senderIsOwner: params.opts.senderIsOwner,
     sessionFile: params.sessionFile,
     workspaceDir: params.workspaceDir,
diff --git a/src/agents/command/types.ts b/src/agents/command/types.ts
@@ -41,6 +41,7 @@ export type AgentRunContext = {
   currentChannelId?: string;
   currentThreadTs?: string;
   currentInboundAudio?: boolean;
+  senderId?: string | null;
   replyToMode?: "off" | "first" | "all" | "batched";
   hasRepliedRef?: { value: boolean };
 };
diff --git a/src/agents/harness/hook-context.ts b/src/agents/harness/hook-context.ts
@@ -25,6 +25,9 @@ export type AgentHarnessHookContext = {
   modelProviderId?: string;
   modelId?: string;
   messageProvider?: string;
+  channel?: string;
+  chatId?: string;
+  senderId?: string;
   trigger?: string;
   channelId?: string;
   contextTokenBudget?: number;
@@ -46,6 +49,9 @@ export function buildAgentHookContext(params: AgentHarnessHookContext): PluginHo
     ...(params.modelProviderId ? { modelProviderId: params.modelProviderId } : {}),
     ...(params.modelId ? { modelId: params.modelId } : {}),
     ...(params.messageProvider ? { messageProvider: params.messageProvider } : {}),
+    ...(params.channel ? { channel: params.channel } : {}),
+    ...(params.chatId ? { chatId: params.chatId } : {}),
+    ...(params.senderId ? { senderId: params.senderId } : {}),
     ...(params.trigger ? { trigger: params.trigger } : {}),
     ...(params.channelId ? { channelId: params.channelId } : {}),
     ...(params.contextTokenBudget ? { contextTokenBudget: params.contextTokenBudget } : {}),
diff --git a/src/auto-reply/reply/agent-runner-execution.test.ts b/src/auto-reply/reply/agent-runner-execution.test.ts
@@ -1838,6 +1838,7 @@ describe("runAgentTurnWithFallback", () => {
     followupRun.run.model = "gpt-5.4";
     followupRun.run.extraSystemPrompt = "dynamic inbound metadata\n\nstable group prompt";
     followupRun.run.extraSystemPromptStatic = "stable group prompt";
+    followupRun.run.senderId = "sender-static";
     followupRun.originatingChannel = "telegram";
 
     const result = await runAgentTurnWithFallback({
@@ -1870,6 +1871,7 @@ describe("runAgentTurnWithFallback", () => {
       trigger: "user",
       messageChannel: "telegram",
       messageProvider: "telegram",
+      senderId: "sender-static",
     });
   });
 
diff --git a/src/auto-reply/reply/agent-runner-execution.ts b/src/auto-reply/reply/agent-runner-execution.ts
@@ -2233,6 +2233,7 @@ export async function runAgentTurnWithFallback(params: {
                     currentMessageId: cliCurrentMessageId,
                     currentInboundAudio: hasInboundAudio(params.sessionCtx),
                     agentAccountId: params.followupRun.run.agentAccountId,
+                    senderId: params.followupRun.run.senderId,
                     senderIsOwner: params.followupRun.run.senderIsOwner,
                     toolsAllow: params.opts?.toolsAllow,
                     disableTools: params.opts?.disableTools,
diff --git a/src/auto-reply/reply/followup-runner.test.ts b/src/auto-reply/reply/followup-runner.test.ts
@@ -1030,6 +1030,8 @@ describe("createFollowupRunner runtime config", () => {
           provider: "anthropic",
           model: "claude-opus-4-7",
           messageProvider: "telegram",
+          senderId: "sender-42",
+          senderIsOwner: true,
           cwd: "/tmp/task-repo",
           inputProvenance: {
             kind: "internal_system",
@@ -1051,6 +1053,8 @@ describe("createFollowupRunner runtime config", () => {
     expect(call.currentChannelId).toBe("telegram:-100123:topic:42");
     expect(call.currentThreadTs).toBe("42");
     expect(call.currentMessageId).toBe("reply-42");
+    expect(call.senderId).toBe("sender-42");
+    expect(call.senderIsOwner).toBe(true);
     expect(call).toMatchObject({
       sessionId: "session-cli-followup",
       sessionKey: "main",
diff --git a/src/auto-reply/reply/followup-runner.ts b/src/auto-reply/reply/followup-runner.ts
@@ -972,6 +972,8 @@ export function createFollowupRunner(params: {
                         : undefined,
                     currentMessageId: followupCurrentMessageId,
                     agentAccountId: run.agentAccountId,
+                    senderId: run.senderId,
+                    senderIsOwner: run.senderIsOwner,
                     disableTools: opts?.disableTools,
                     abortSignal: runAbortSignal,
                   },
diff --git a/src/auto-reply/reply/get-reply.before-agent-reply.test.ts b/src/auto-reply/reply/get-reply.before-agent-reply.test.ts
@@ -86,7 +86,11 @@ describe("getReplyFromConfig before_agent_reply wiring", () => {
       reply: { text: "plugin reply" },
     });
 
-    const result = await getReplyFromConfig(buildGetReplyGroupCtx(), undefined, {});
+    const result = await getReplyFromConfig(
+      buildGetReplyGroupCtx({ SenderId: "telegram-user-42" }),
+      undefined,
+      {},
+    );
 
     expect(result).toEqual({ text: "plugin reply" });
     expect(mocks.runBeforeAgentReply).toHaveBeenCalledTimes(1);
@@ -99,6 +103,7 @@ describe("getReplyFromConfig before_agent_reply wiring", () => {
           sessionId?: string;
           workspaceDir?: string;
           messageProvider?: string;
+          senderId?: string;
           trigger?: string;
           channelId?: string;
         },
@@ -110,6 +115,7 @@ describe("getReplyFromConfig before_agent_reply wiring", () => {
     expect(hookCtx.sessionId).toBe("session-1");
     expect(hookCtx.workspaceDir).toBe("/tmp/workspace");
     expect(hookCtx.messageProvider).toBe("telegram");
+    expect(hookCtx.senderId).toBe("telegram-user-42");
     expect(hookCtx.trigger).toBe("user");
     expect(hookCtx.channelId).toBe("-100123");
     expect(mocks.handleInlineActions.mock.invocationCallOrder[0]).toBeLessThan(
diff --git a/src/auto-reply/reply/get-reply.ts b/src/auto-reply/reply/get-reply.ts
@@ -944,6 +944,7 @@ export async function getReplyFromConfig(
               messageProvider: hookMessageProvider,
               currentChannelId: sessionCtx.OriginatingTo ?? ctx.OriginatingTo ?? ctx.To,
               messageTo: sessionCtx.OriginatingTo ?? ctx.OriginatingTo ?? ctx.To,
+              senderId: sessionCtx.SenderId ?? ctx.SenderId,
             }),
           },
         ),
diff --git a/src/plugins/hook-agent-context.test.ts b/src/plugins/hook-agent-context.test.ts
@@ -64,10 +64,29 @@ describe("buildAgentHookContextChannelFields", () => {
         sessionKey: "agent:main:discord:channel:c1",
         messageChannel: "discord",
         messageProvider: "discord",
+        senderId: "user-123",
       }),
     ).toEqual({
+      channel: "discord",
       messageProvider: "discord",
       channelId: "c1",
+      chatId: "c1",
+      senderId: "user-123",
+    });
+  });
+
+  it("uses the provider as channel when message channel is a target id", () => {
+    expect(
+      buildAgentHookContextChannelFields({
+        messageChannel: "channel:1472750640760623226",
+        messageProvider: "discord",
+      }),
+    ).toEqual({
+      channel: "discord",
+      messageProvider: "discord",
+      channelId: "1472750640760623226",
+      chatId: "1472750640760623226",
+      senderId: undefined,
     });
   });
 });
diff --git a/src/plugins/hook-agent-context.ts b/src/plugins/hook-agent-context.ts
diff --git a/src/plugins/hook-types.ts b/src/plugins/hook-types.ts
